Splunk Add-On for AWS: should I use 1 or many SQS for the various inputs?

[lhanich1]

I am currently utilizing SQS ingestion for all the inputs within the app. I am noticing some duplicity with the sources indexing across 2 different indexes. Should I be using a different SQS for each input? As of now, we are using 1 SQS stream across all the inputs within the Splunk Add On for AWS.

Thanks

[amiracle]

What are the two indexes you are seeing the data flow into? By default the add-on will write the data to the main or default index. Then the saved searches will summarize some of the data and put them into summary indexes. That is normal behavior, so before you stop ingesting data, let's make sure you're not looking at both the summary and default indexes.

[lhanich1]

Every Input is designated to its rightful index so it is not all dumping into 1 index.